{"record":{"id":"dec9b4f893686759","repo":"BerriAI/litellm","slug":"azure-sentinel-endpoint-is-required-set-it-as-an","errorCode":null,"errorMessage":"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.","messagePattern":"AZURE_SENTINEL_ENDPOINT is required\\. Set it as an environment variable or pass endpoint parameter\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/integrations/azure_sentinel/azure_sentinel.py","lineNumber":109,"sourceCode":"        resolved_endpoint: Final = endpoint or os.getenv(\"AZURE_SENTINEL_ENDPOINT\")\n        resolved_tenant_id: Final = tenant_id or os.getenv(\"AZURE_SENTINEL_TENANT_ID\") or os.getenv(\"AZURE_TENANT_ID\")\n        resolved_client_id: Final = client_id or os.getenv(\"AZURE_SENTINEL_CLIENT_ID\") or os.getenv(\"AZURE_CLIENT_ID\")\n        resolved_client_secret: Final = (\n            client_secret or os.getenv(\"AZURE_SENTINEL_CLIENT_SECRET\") or os.getenv(\"AZURE_CLIENT_SECRET\")\n        )\n        resolved_authority_host: Final = self._normalize_authority_host(\n            authority_host\n            or os.getenv(\"AZURE_SENTINEL_AUTHORITY_HOST\")\n            or os.getenv(\"AZURE_AUTHORITY_HOST\")\n            or DEFAULT_AZURE_AUTHORITY_HOST\n        )\n\n        if not resolved_dcr_immutable_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_DCR_IMMUTABLE_ID is required. Set it as an environment variable or pass dcr_immutable_id parameter.\"\n            )\n        if not resolved_endpoint:\n            raise ValueError(\n                \"AZURE_SENTINEL_ENDPOINT is required. Set it as an environment variable or pass endpoint parameter.\"\n            )\n        if not resolved_tenant_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_TENANT_ID or AZURE_TENANT_ID is required. Set it as an environment variable or pass tenant_id parameter.\"\n            )\n        if not resolved_client_id:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_ID or AZURE_CLIENT_ID is required. Set it as an environment variable or pass client_id parameter.\"\n            )\n        if not resolved_client_secret:\n            raise ValueError(\n                \"AZURE_SENTINEL_CLIENT_SECRET or AZURE_CLIENT_SECRET is required. Set it as an environment variable or pass client_secret parameter.\"\n            )\n\n        self.dcr_immutable_id = resolved_dcr_immutable_id\n        self.stream_name = resolved_stream_name\n        self.audit_stream_name = resolved_audit_stream_name","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/integrations/azure_sentinel/azure_sentinel.py#L91-L127","documentation":"AzureSentinelLogger.__init__ requires the Azure Monitor Logs Ingestion endpoint: it checks the endpoint kwarg then the AZURE_SENTINEL_ENDPOINT env var and raises if neither resolves. This is the ingestion URI of your Log Analytics workspace (https://<deployment-id>.ingest.monitor.azure.com), not the workspace resource ID and not the analytics/query API endpoint.","triggerScenarios":"Enabling the azure_sentinel callback with only the DCR and Entra credentials configured; pasting the workspace ID or customer-id instead of the ingestion URI; exporting AZURE_SENTINEL_ENDPOINT as an empty string; regional workspace whose endpoint differs from the one copied from another environment.","commonSituations":"Confusing the query endpoint (api.loganalytics.io) or workspace agent endpoints with the logs ingestion endpoint; docs that stop after DCR creation; multi-region deployments copying env between regions.","solutions":["Get the value from the Log Analytics workspace / DCR environment: portal -> Log Analytics workspace -> 'View data collection rules' / workspace properties 'Ingestion endpoint', or `az monitor log-analytics workspace show --query publicIngestionEnabled`-adjacent properties; use the https://<id>.ingest.monitor.azure.com form","Or pass endpoint=\"https://<id>.ingest.monitor.azure.com\" to the constructor","Fill in the remaining required values (DCR immutable id, tenant, client id, secret) in the same change"],"exampleFix":"// before\nexport AZURE_SENTINEL_ENDPOINT=\"my-workspace\"          # workspace name, wrong shape\n// after\nexport AZURE_SENTINEL_ENDPOINT=\"https://my-ws-o1.ingest.monitor.azure.com\"","handlingStrategy":"validation","validationCode":"import os\n\nendpoint = os.getenv(\"AZURE_SENTINEL_ENDPOINT\", \"\")\nif not endpoint.startswith(\"https://\") or \".ingest.monitor.azure.com\" not in endpoint:\n    raise RuntimeError(\n        \"AZURE_SENTINEL_ENDPOINT must be the logs ingestion URI \"\n        \"(https://<id>.ingest.monitor.azure.com), got: %r\" % endpoint\n    )","typeGuard":"def is_ingestion_endpoint(url: str) -> bool:\n    return url.startswith(\"https://\") and url.endswith(\".ingest.monitor.azure.com\")","tryCatchPattern":null,"preventionTips":["Record the ingestion endpoint alongside the DCR id when provisioning — they are a pair","Distinguish it from the query API (api.loganalytics.io) and workspace agent endpoints in runbooks","Assert the endpoint shape at deploy time, not at first log write","Template env per region so cross-region copies cannot reuse a stale endpoint"],"tags":["azure-sentinel","azure-monitor","logs-ingestion","litellm","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}